apache/cassandra · error · InvalidRequestException

is not a member of

Error message

%s is not a member of %s

What it means

InvalidRequestException from revokeRole when attempting to revoke a membership that does not exist: the grantee role is not currently a member of the named role. The manager checks current membership (including via getRoles with inherited membership) before deleting the row in system_auth.role_members, and this guard rejects the no-op revoke.

Solutions

1. Confirm current memberships with LIST ROLES or by querying system_auth.role_members
2. Revoke membership using the exact role/member pair that exists (roles and member direction are easy to swap)
3. Create the membership with GRANT before trying to REVOKE it

When it happens

Trigger: Thrown at src/java/org/apache/cassandra/auth/CassandraRoleManager.java:433 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/1103a32052f77683. Report an issue: GitHub.

Appendix: source

Thrown at src/java/org/apache/cassandra/auth/CassandraRoleManager.java:433

        if (getRoles(role, true).contains(grantee))
            throw new InvalidRequestException(String.format("%s is a member of %s",
                                                            role.getRoleName(),
                                                            grantee.getRoleName()));

        modifyRoleMembership(grantee.getRoleName(), role.getRoleName(), "+");
        process(String.format("INSERT INTO %s.%s (role, member) values ('%s', '%s')",
                              SchemaConstants.AUTH_KEYSPACE_NAME,
                              AuthKeyspace.ROLE_MEMBERS,
                              escapeCqlLiteral(role.getRoleName()),
                              escapeCqlLiteral(grantee.getRoleName())),
                consistencyForRoleWrite(role.getRoleName()));
    }

    public void revokeRole(AuthenticatedUser performer, RoleResource role, RoleResource revokee)
    throws RequestValidationException, RequestExecutionException
    {
        if (!getRoles(revokee, false).contains(role))
            throw new InvalidRequestException(String.format("%s is not a member of %s",
                                                            revokee.getRoleName(),
                                                            role.getRoleName()));

        modifyRoleMembership(revokee.getRoleName(), role.getRoleName(), "-");
        process(String.format("DELETE FROM %s.%s WHERE role = '%s' and member = '%s'",
                              SchemaConstants.AUTH_KEYSPACE_NAME,
                              AuthKeyspace.ROLE_MEMBERS,
                              escapeCqlLiteral(role.getRoleName()),
                              escapeCqlLiteral(revokee.getRoleName())),
                consistencyForRoleWrite(role.getRoleName()));
    }

    public Set<RoleResource> getRoles(RoleResource grantee, boolean includeInherited)
    throws RequestValidationException, RequestExecutionException
    {
        return collectRoles(getRole(grantee.getRoleName()),
                            includeInherited,
                            filter(),

View on GitHub (pinned to 88fd0f6a0e)